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Serial No. 
Group Art Unit 
Examiner 
Title 



Filing Date 
Inventor /Applicant 



10/722, 423 
2616 

YUEN, Kan 

NETWORK BANDWIDTH ANOMALY DETECTOR 
APPARATUS, METHOD, ' SIGNALS AND MEDIUM 
November 28, 2003 
MACISAAC, Gary Lome 



March 13, 2009 



U.S. Commissioner of Patents and Trademarks 
U.S. Patent and Trademark Office 
Box 1450 

Alexandria, VA 22313-1450 
U.S.A. 



Sir: 



In accordance with 35 U.S.C. 301, Applicant submits the 
following information to the Examiner in charge of the above- 
referenced application for patent. 

Copies. of non-patent references cited as prior art by the 
Japanese Examiner in a related Japanese Patent Application 
were submitted with a Supplemental Information Disclosure 
Statement dated September 30, 2008 and included a reference by 
Takei, et al (2001) . After careful review, the Applicant 
considers the Takei, et al (2001) reference (English 
translation: Takei, et al) a significant prior art publication 
that discloses key elements of the Applicant's present 
invention. Copies of the two web-based citations and 
abstracts are enclosed. 

Takei, et al discloses a system and method for detecting 
Denial of Service (DoS) attacks by monitoring and correlating 
inbound and outbound traffic patterns from given observation 
points. It is readily apparent there are a number of 
components in Takei, et al that disclose claims 1, 2, 3, 5, 
11, 12, 13, 14, 21, 22, 26, 28, 30, 31, 32, 34, 36, 37, 38, 40 
and associated dependent claims in a manner that would be 
obvious to one of ordinary skill in the art. 

Referring to Takei, et al, each of the elements of claims 1, 
37, 38 and 40 are disclosed by Takei, et al. Specifically, 
comparing Figure 8 on page 65 with Figure 9 on page 66, each 
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showing a time distribution of data volume, makes it 
immediately apparent that the traffic patterns in a first 
direction (Fig. 8) and a second direction (Fig. 9) are 
correlated. A method of calculation of a correlation between 
two time distributions of data volume (time-series) is 
disclosed on pages 63 and 64 as equations (1) and (2) along 
with the text description. 

Referring to Takei, et al, claims 2 and 3 are disclosed on 
page 64, in section 2.5 which describes observing traffic 
patterns in both uplink and downlink directions. Figure 5 
illustrates the generation of an anomaly signal based on the 
outcome of comparing a threshold for a correlation of two 
patterns of packet counts over time. 

In another example, Takei, et al disclose claims 12 and 13 on 
page 62, column 1, paragraph 5 (last paragraph) where the use 
of SNMP MIB II statistics is described . and notably that their' 
method does not require the extraction and analysis of packet 
contents thereby providing scalability to higher speed 
networks. 

Although the Applicant's claims include the use of Discrete 
Wavelet Transform as a statistical measure to be correlated, 
the key requirement is the comparison of two time 
distributions of data volumes.. On page 62, column -1, 
paragraph 5 a reference is made to using the "time-series 
characteristics of the numbers of packets that transit the 
monitoring points". Transformations simply change the type of 
time series structure and scales of the packet counts being 
compared. 

In summary, there are many aspects of the newly uncovered 
prior art of Takei, et al, which reveal features of the 
present application, such that in view of Takei, et al the 
Applicant must acknowledge the claims would be obvious to one 
of average skill in the art. 

Respectfully submitted, 




3708 Wfest 36 th Avenue 
Vancouver, British Columbia 
Canada V6N 2S4 



Encl . 
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